A hidden line in an email can trick an AI assistant into harmful actions

A hidden instruction in an email, a shared document or a support ticket can push an AI assistant into doing things its owner never approved. That is the warning from J.D. Salbego, founder and CEO of ClawSecure, an AI agent security company, in an interview with PYMNTS.

How the trick works

The attack is called indirect prompt injection. An AI agent is a program that can act for you, such as reading files or using connected apps. The attacker does not need a person to approve a bad payment. The agent reads the hidden text and may simply follow it. Neither the user nor the agent may notice.

What the testing found

ClawSecure tested 14 AI models from five labs. Salbego said the work found a repeating pattern across models and across connected apps including Dropbox, Notion and Linear. Testing several providers was meant to show whether the weakness goes beyond a single model. The interview does not lay out the findings in detail.

Connected apps give an attacker more routes. Salbego described an agent working through Dropbox that could also connect to Gmail. Requests that look ordinary on their own can look different when viewed together. "You have to watch and understand the messaging between a model and a tool," he said.

Who is most exposed

Salbego pointed to small businesses and consumers. Simple setup services let people with little technical experience connect financial and business accounts, and they have no security team. For a small business, the account used to run the company could be at risk. For a consumer, it could be passwords or private financial information. Large companies have security staff, but an agent's access can widen the damage.

What Salbego wants

• Providers should say publicly where their protections end and what customers must supply.
• Continuous monitoring of agent behavior while it runs, not only built-in model defenses.
• Public, comparable safety ratings run by a government body such as NIST, with voluntary participation.

He said he has discussed agent security with congressional offices from both parties and with the Federal Trade Commission. He also noted that ClawSecure sells security services, so it would not run the ratings itself. He said getting such a program running will take time.

What to do

Salbego's advice for bank technology executives was blunt: shut down every AI agent while arranging security help and ongoing protection. For everyone else, the practical step is to check what an assistant can reach, such as email, files or money accounts, and who is watching it.